Recently at Black Hat, the Cenzic Web Security booth were giving away LED message fans:

CIMG2496[1]

Craig from Hacking With Gum got hold of one of these fans and decided to dismantle it.

He was in luck when finding a pin header:

CIMG2501[1]

There was a little chip connected to the header, and this turned out to be a Atmel I2C 2KB EEPROM chip.

With a RS-232 circuit he built, he managed to decode the EEPROM data, modify it and re-upload the program.

It turned out just great.

View his full story, tutorial and videos about this at http://hackingwithgum.com/2009/10/06/hacking-the-cenzic-pov-fan/

 

Here’s some extra pics:

CIMG2506[1]  original_cenzic_data_dump[1]